ISC2 CC cheat sheet — every exam topic on one page

Security Principles

CIA Triad, AAA, and Non-Repudiation: Core ISC2 CC Security Concepts

• CIA = Confidentiality (only authorized eyes), Integrity (accurate and unaltered), Availability (usable when needed)
• Match controls to properties: encryption protects confidentiality, hashing protects integrity, backups and redundancy protect availability
• A bare hash proves data is unchanged, not who produced it; proof of origin needs a digital signature
• Data poisoning (training data) and model poisoning (the model itself) are integrity attacks; hashes taken at approval catch later changes, while provenance and data review address poison that was there from the start
• The CIA properties have no fixed priority order - the business purpose of each system decides which leads, and one person holding the only encryption key is an availability risk
• DoS attacks and ransomware target availability; unauthorized modification targets integrity; snooping and breaches target confidentiality
• The three A's run in order: authentication proves who you are, authorization decides what you may do, accounting records what you did
• MFA requires two or more different factor types (know, have, are) - a password plus a PIN is still single-factor
• Non-repudiation means an action cannot be credibly denied; digital signatures are the primary mechanism, and logs held by one party are only supporting evidence
• Shared accounts defeat non-repudiation: MFA, tamper-proof logs and session recording do not identify the person - only unique per-person identities do
• Privacy governs personal data (PII) end to end - it uses confidentiality controls but also limits collection, use, and retention; aggregated statistics with no link to a person are not PII

Risk Management for the ISC2 CC Exam: Lifecycle, Assessment, and Treatment

• Risk = likelihood x impact; it exists only where a threat can exploit a vulnerability in an asset
• Threat is the external potential for harm; vulnerability is the internal weakness it exploits - keep them separate
• Threat actor = who is behind an attack; threat vector = the path it uses; risk owner = who is accountable for managing the risk
• The lifecycle runs identify, assess, treat, monitor - and repeats forever; identification always comes first
• Vulnerability assessments and threat modeling feed identification; rating risk by likelihood and impact is assessment
• Qualitative assessment uses low/medium/high ratings and judgment; quantitative uses monetary values and expected loss
• The four risk responses are avoid (stop the activity), mitigate (apply controls), transfer (insurance/outsourcing), accept (documented, informed decision)
• Transfer shifts financial impact but never accountability; ignoring a risk is not acceptance
• Residual risk is what remains after controls - the goal is residual risk within the organization's appetite and tolerance, not zero risk
• Management, not the security analyst, formally accepts risk on behalf of the organization
• Appetite is the broad stance and tolerance the specific limit, though ISC2's glossary also treats them (and acceptable risk) as near-synonyms

Security Governance: Laws, Frameworks, Policies, Standards, Procedures

• Laws and regulations are mandatory, externally imposed, and enforced by government regulators with penalties
• GDPR reaches non-EU organizations that offer goods or services to, or monitor, people in the EU; it turns on location, not citizenship
• HIPAA applies to covered entities (health plans, clearinghouses, electronically transacting providers) and their business associates, not to every holder of health data
• PCI DSS is mandatory by contract, not by law; card brands and acquirers enforce it
• NIST CSF 2.0 has six functions (Govern, Identify, Protect, Detect, Respond, Recover), is voluntary, and has no certification
• ISO/IEC 27001 is the certifiable ISMS standard; ISO/IEC 27002 is control guidance; CIS Controls prioritize safeguards and CIS Benchmarks configure products
• An external standard written into policy becomes a mandatory internal standard; certification is assurance, not the source of the obligation
• A policy is a mandatory, high-level statement of management intent, binding because management approved it
• Standards set specific mandatory requirements, procedures give mandatory steps, and the guideline is the only optional document

Security Controls: Technical, Administrative, and Physical Types

• Control type describes implementation: technical (logical), administrative (managerial), or physical
• Technical controls are enforced by hardware and software: firewalls, encryption, ACLs, IDS and IPS, MFA
• Administrative controls work through people and process: policies, training, background checks, risk assessments
• Physical controls protect tangible spaces: locks, guards, fences, badges, CCTV, mantraps; one control has one type but can serve several functions, like CCTV being physical, detective and deterrent
• A written policy is administrative; the system enforcing it is technical, including AI acceptable-use policies versus DLP blocks
• Separation of duties is preventive (fraud needs collusion); job rotation is mainly detective (a successor finds irregularities)
• An out-of-band IDS inspects a duplicate of traffic and alerts (detective); an inline IPS can drop traffic (preventive)
• Defense in depth layers controls of all three types so no single failure exposes the asset; zero trust verifies every access request
• Functions describe purpose: preventive stops, detective finds, corrective restores, deterrent discourages, compensating substitutes; timing can change the function
• Pick the control that directly removes the stated risk, such as encryption for stolen laptops or a mantrap for tailgating

ISC2 Code of Ethics, Due Care, and Due Diligence for the CC Exam

• Due care is action: taking the reasonable precautions a prudent person would take; falling below that standard is negligence.
• Due diligence is investigation and verification: the ongoing research and checking that informs due care and confirms it works.
• Diligence without care is not enough: an approved assessment whose controls are never deployed shows diligence but not care.
• The four ISC2 canons in order of precedence: protect society; act honorably; serve principals; advance the profession.
• In a conflict the higher canon prevails, and the method must still be responsible: escalate and disclose responsibly, never release attack details prematurely or simply walk away.
• The Code binds ISC2 certification holders from CC to CISSP; employer codes of conduct and AUPs bind staff and are enforced by the employer.
• The preamble requires members to adhere, and be seen to adhere, to the highest ethical standards; adherence is a condition of certification.
• Complaints must be written, sworn, name the canon and come from someone with standing; the Ethics Committee reviews (it does not investigate), the Board decides, and sanctions run up to revocation.
• AI does not move accountability: verify AI output, be open about its use, report harmful bias to decision makers and the vendor, and keep automated decisions about people explainable and reviewable (NIST AI RMF trustworthy-AI characteristics).

Security Governance

Governance, Risk, and Compliance (GRC) for the ISC2 CC Exam

• Governance is leadership setting direction: policy, accountability, and alignment of security with business objectives.
• Governance decides what should happen and verifies it did; management executes it day to day.
• Risk management keeps the organization operating within the risk appetite set by leadership; a risk above appetite is escalated to that leadership, and the decision is recorded in the risk register.
• Compliance covers external laws and regulations plus the organization's own internal policies; ignoring your own policy is a compliance gap.
• Evidence must be created when the control operates; an unrecorded occurrence counts as not performed, and later assurances or late re-runs do not fill it.
• A policy is design evidence; completion records, sign-offs and logs are operating evidence. Internal and external audits verify compliance by testing controls against both.
• Integrating GRC into one program prevents silos, duplicated effort, and inconsistent decisions.
• Frameworks are generic baselines: they don't tailor controls, replace risk assessment or prove legal compliance on their own.
• A GRC platform links policies, risks, mapped controls and evidence; a missing record for a mapped control is a gap for every framework that uses it.

Business Continuity, Disaster Recovery, and Redundancy Explained

• BC keeps critical business functions running during a disruption; DR restores IT systems and data after it.
• DR is a subset of BC: BC covers people, processes, and facilities, while DR focuses only on IT.
• The BIA comes first: it identifies critical functions and their maximum tolerable downtime, and plans are built on it.
• RTO is how quickly a system must be restored: it measures downtime, forward from the outage.
• RPO is how much data loss is tolerable: it measures backward in time and dictates backup frequency.
• The RTO must be set at or below the maximum tolerable downtime; MTBF is a reliability measure, not a recovery target.
• Judge an incident with two clocks from the failure: forward to restoration for RTO, backward to the last good copy for RPO.
• RAID and failover are redundancy against component failure; they are not backups and copy deletion or ransomware damage straight through.
• High availability means removing every single point of failure, layer by layer; a second component that still depends on the same switch, circuit, or link does not count.
• Mirrored and hot sites recover fastest at the highest cost, cold sites are cheapest but slowest, and warm sites sit between; pick per system from its RTO.
• An untested backup or DR plan is unproven: restores and recovery procedures must be exercised.

Security Awareness: Social Engineering, Phishing, and Password Hygiene

• Security is everyone's responsibility; leadership tone from the top and a blame-free reporting culture make awareness effective
• Executives get no exemptions: reduce friction with an easier factor such as a hardware key, because whaling targets need MFA most
• Social engineering manipulates people using authority, urgency, scarcity, familiarity, intimidation, and social proof; a deadline on a demand is urgency, an opportunity running out is scarcity
• Phishing is email-based; spear phishing targets a specific person, and whaling targets executives
• Smishing is phishing over SMS text messages; vishing is phishing over voice calls
• Pretexting invents a false scenario, baiting lures victims with a tempting item, and tailgating follows someone through a secure door
• Prefer long unique passphrases, never reuse or vary one base password, and use a password manager
• MFA stops a stolen password from being used; lockout, a password change, or MFA on a different account do not
• Verify payment changes using contact details held before the request; a genuine sender address can come from a compromised mailbox
• Do not interact, verify out of band, and report immediately; a clean antivirus scan is not a reason to skip reporting
• Simulated phishing coaches immediately and tracks both click and report rates; rising reports after a blame-free policy mean better visibility, not worse security

Measuring Security Effectiveness: Metrics, KPIs, and Key Risk Indicators

• You cannot manage what you do not measure; metrics turn security from faith into evidence for decisions
• Good metrics are meaningful and actionable; a number nobody acts on is a vanity metric
• Activity and volume counts can rise without capability changing, and completion rates measure coverage, not effect; decisions rest on outcome metrics read as trends
• Core security KPIs include patching timeliness, incident counts, MTTD, MTTR, and training completion rates
• MTTD runs from incident start to discovery, MTTR from discovery to containment; split a timeline at discovery and the longer interval shows the weaker capability
• Trend and target are separate questions: a metric can improve and still miss its target, and a rising time-based metric is getting worse
• MTTR is a measured incident-handling average; RTO is a continuity target and MTBF a reliability measure
• A false positive is an alert on benign activity (wasted analyst time); a false negative is a missed attack (the more dangerous error), and a falling alert count can hide a rising false negative rate
• Model drift is an AI model's gradual loss of accuracy as activity and attacks move away from its training data, unlike poisoning, which corrupts the training data; track AI detection metrics against a baseline and retrain when they slip
• A KPI is typically a lagging measure of past performance; a KRI is a forward-looking, leading indicator, and wording cues such as early warning or signals rising risk point to it
• KRIs are paired with thresholds that trigger escalation to management when crossed
• A breached KRI threshold is escalated promptly to the risk owner for a decision; it is not an incident, and resetting the threshold to match the new value hides the risk
• Dashboards give real-time operational views, scorecards rate performance against targets, and reports add narrative and recommendations tailored to the audience

Identity And Access Management (IAM) Concepts

Identity Life Cycle Management: Provisioning, Review, and Deprovisioning

• The identity life cycle is roles definition, provisioning, review and deprovisioning; it is a loop, and recurring review findings are fixed in the role definition.
• Provision from the job's own role profile only: never copy a colleague's or manager's access, and have the resource owner approve any exception before it is granted.
• Identity proofing checks the person before an account or a replacement credential is issued; authentication checks the credential at every sign-in. MFA cannot stop an impostor who was issued the credential.
• Every user gets a unique account; controls layered on a shared login never give the system per-person attribution.
• Over-provisioning happens at grant, privilege creep accumulates as people move, privilege escalation is gaining unauthorized higher rights.
• Access reviews are a detective backstop; deprovisioning at separation is the primary control against orphaned accounts. Review privileged access more often, and review when temporary assignments end.
• Access ends when the business need ends: at the close of the last working day for a resignation, at or before notification for a termination (every account and remote path), and when garden leave begins.
• Account expiration dates are a backstop for temporary users, not a replacement for disabling them at an early or involuntary exit.
• Deprovisioning must reach applications with local logins, not just the SSO identity; disable first, delete later per retention policy.
• Service accounts have no HR events, so each needs a named owner; PAM vaults admin credentials and replaces standing admin rights with just-in-time elevation.
• An AI agent is a non-human identity: give it its own account with a named human owner, scope its role to the task (excessive agency), and on retirement disable the identity and revoke every key and token, because switching off the model leaves credentials live.

Logical Access Controls: Least Privilege, DAC, MAC, and RBAC

• Least privilege: the minimum access current duties require, no more and no less, ending when the job or contract ends.
• Administrators use a standard account daily and a personal privileged account only when needed; shared admin accounts destroy accountability.
• Privilege creep is a legitimate user accumulating access; privilege escalation is an attacker gaining rights beyond those granted.
• AI agents are non-human identities: scope them to the task, run them with the requesting user's permissions, and never rely on prompt instructions as an access control.
• Need-to-know comes from current duties: clearance, seniority, admin control of a system, or a signed request do not create it.
• Separation of Duties splits a process so fraud needs collusion; where duties cannot be split, independent review compensates.
• Dual control (two-person control) puts two people on one action; split knowledge gives each person part of a secret; both fail to collusion.
• Job rotation and mandatory vacations are detective and work only if someone else performs the duties during the absence.
• DAC: the owner decides, and malware running as the owner inherits that discretion; MAC: system-enforced labels that no owner grant can override.
• RBAC: access follows the job role and scales; access reviews detect creep afterwards; role explosion is why context moves to ABAC.
• When a question asks which model, ask who decides: owner (DAC), system (MAC), role (RBAC), attributes (ABAC).
• Risk-based MFA steps a sign-in up to an extra factor only when context (device, location, behaviour) looks risky; SSO, federation, and RBAC do something different.

Networking and Cloud Security Concepts

Network Security Basics: OSI Model, TCP/IP, Firewalls, and VPNs

• The OSI model has seven layers; the TCP/IP model has four, with the TCP/IP Application layer covering OSI layers 5 to 7.
• IP addresses and routing are Layer 3; MAC addresses (48-bit, six hex pairs) and switches are Layer 2; TCP and UDP with port numbers are Layer 4.
• IPv4 addresses are 32-bit; IPv6 addresses are 128-bit hexadecimal, shortened with a single double colon, created because IPv4 addresses ran out.
• Private ranges 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 are not routed on the internet; NAT shares a public address but is not a security control.
• A firewall rule matches only when every field matches; unmatched traffic hits the final default-deny rule, and each allowed flow should be as narrow as possible.
• Stateless filters judge each packet alone, stateful firewalls track connections, and next-generation firewalls add application identification on top of both.
• Signature detection catches known attacks with few false alarms; AI/ML anomaly detection learns a clean baseline to catch new attacks at the cost of more false positives, so use both; an IDS alerts, an inline IPS or firewall blocks.
• Know the core ports and pairs: Telnet 23 to SSH 22, HTTP 80 to HTTPS 443, FTP 21 to SFTP over SSH, plus DNS on 53; a nonstandard port encrypts nothing.
• A VPN gives confidentiality inside the tunnel but does not authenticate the local access point; use WPA3 or WPA2, never WEP or TKIP-based WPA; hiding the SSID is not encryption; keep Bluetooth non-discoverable when not pairing.
• IoT, embedded and ICS devices are long-lived, rarely patched and weakly configured, so isolate them on their own segment; an IDS only detects.

Network Security Architecture: Zero Trust, Defense in Depth, Segmentation

• Segmentation limits lateral movement: an attacker's foothold in one zone cannot freely reach systems in another.
• The DMZ is a buffer zone between the untrusted internet and the trusted internal network, and it is where public-facing servers belong.
• VLANs segment a network logically at Layer 2, letting one physical switch act as several isolated networks whose interconnections cross a control point.
• Traffic between hosts in the same VLAN never reaches the inter-VLAN firewall, so that firewall cannot block or log it; VLANs separate traffic but do not encrypt it.
• A DMZ-to-internal exception follows least privilege: one named source, one named destination, one needed port; sensitive internal systems stay in the trusted zone.
• Micro-segmentation applies policy per individual workload, stopping lateral movement even between servers in the same segment.
• Defense in Depth layers multiple independent controls so that no single control's failure exposes the asset.
• Depth needs controls that differ in kind and position; a second firewall at the same edge is mostly redundancy, guarding against device failure rather than an attacker on an allowed path.
• Zero Trust's core principle is never trust, always verify: no implicit trust based on network location, every request authenticated and authorized.
• Zero Trust enforces least privilege, assumes breach, and uses micro-segmentation as a key enabler; it is an architecture, not a product.
• Zero Trust access needs both verification and entitlement, re-evaluated as signals change; assume breach means filtering and monitoring east-west traffic.
• AI training data stores and training or inference clusters belong in their own segment with default-deny rules, including no internet egress, which protects training-data integrity against poisoning from compromised internal hosts; AI services are non-human identities verified per request under least privilege.
• The castle-and-moat model fails because implicit trust by location cannot stop insiders, stolen credentials, or lateral movement.

Cloud Security: Shared Responsibility, IaaS vs PaaS vs SaaS, Deployment Models

• The five essential cloud characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service.
• IaaS rents infrastructure (you manage the OS up), PaaS rents a managed platform (you bring code and data), SaaS rents a finished application (you bring data and users).
• Deployment models by who is served: public (everyone), private (one organization, on or off premises), community (a group with shared requirements), hybrid (two or more distinct clouds bound together, in any combination).
• Shared responsibility: the provider secures the cloud (physical, hardware, virtualization); the customer secures what is in the cloud (data, access, configuration).
• Resource pooling puts unrelated tenants on shared hosts; isolating them, and fixing virtualization-layer flaws, is the provider's duty. Dedicated hosts give exclusive hardware but not control of the facility.
• Customer responsibility is greatest in IaaS, smaller in PaaS, and smallest in SaaS - the more the provider manages, the more security it absorbs.
• The customer is always responsible for their data, identities, and configuration, in every service model - including SaaS.
• In IaaS the customer patches the operating system; in PaaS and SaaS the provider does.
• A publicly exposed storage bucket is a customer misconfiguration, not a provider failure - accountability for data never transfers to the provider.
• An SLA sets measurable service levels and remedies such as service credits; an AUP sets usage rules, an NDA protects confidential information, and an MOU records intent.
• Backups of your own data and retention of your own audit logs are yours unless the contract says otherwise; provider encryption at rest does not stop an attacker using a valid phished login.

Security Operations and Incident Response

Data Security: Classification, Masking, Sanitization, and Encryption Basics

• Classification labels data by sensitivity (for example public, internal, confidential, restricted) and determines its protection; labeling marks the asset itself so DLP tools, gateways and people can enforce the class.
• Classified data entered into a public generative AI service is data leakage (a confidentiality loss), not model poisoning, drift or prompt injection; AI-use rules are set per classification level, and labels let DLP block labeled data bound for public AI without banning the tool.
• Dynamic masking hides values at display time and leaves production data intact; static masking replaces values in a test/dev copy while keeping realistic formats. Neither uses a key.
• Deleting or quick-formatting is not sanitization. Overwrite magnetic drives, crypto-erase self-encrypting SSDs (overwriting can miss remapped flash blocks), degauss magnetic media only, or physically destroy.
• Data has three states - at rest (stored), in transit (moving), in use (processed) - and each needs protection.
• Symmetric encryption uses one shared key, is fast, suits bulk data (AES); its weakness is key distribution.
• Asymmetric encryption uses a public and private key pair (RSA) and solves key distribution, but is slow; hybrid encryption protects a symmetric key with the recipient's public key, and a private-key signature gives non-repudiation that a shared-key check cannot.
• Hashing (SHA-256) is one-way, keyless, and proves integrity - it is not encryption and provides no confidentiality.
• Quantum computers threaten public-key algorithms (RSA, ECC), not AES-256 or SHA-256 in practice; harvest-now-decrypt-later means data with the longest secrecy lifetime migrates its key exchange first.

Security Operations: Logging, Monitoring, SIEM and Threat Intelligence

• Logs are the record of system events; monitoring means reviewing them continuously, not just after a breach.
• A SIEM aggregates, normalizes, and correlates logs from across the environment and raises alerts; the SOC is the security team that operates it, while a NOC watches network availability and performance.
• Triage prioritizes security events by severity and business impact so analysts work the riskiest alerts first.
• Correlation links related events from different systems into one picture and reduces false positives.
• AI in a SIEM/SOC groups and ranks alerts to cut alert fatigue but remains detective; analysts verify AI verdicts against log evidence, and logs go only into approved, organization-controlled AI tools.
• Match actors to motives: nation-state/APT = espionage, organized crime = money, hacktivist = ideology, insider = access abuse, script kiddie = notoriety.
• CTI turns threat data into actionable knowledge at strategic (executives), operational (managers), and tactical (SOC analysts) levels.
• MITRE ATT&CK catalogs adversary tactics (why) and techniques (how); the Cyber Kill Chain is a 7-stage attack sequence, and breaking one link stops the attack.

Incident Response: The IR Plan, Phases, CSIRT and Tabletop Exercises

• An event is any observable occurrence; an incident is an event that harms or threatens confidentiality, integrity, or availability, or violates security policy.
• The IRP is written and approved before an incident and defines criteria, roles and decision authority, escalation paths, procedures, and communication rules.
• Only the designated spokesperson talks to media and customers; every other responder refers enquiries to the communications lead, even for a 'safe' holding line.
• NIST SP 800-61 Rev. 2 phase order: Preparation, then Detection and Analysis, then Containment, Eradication and Recovery, then Post-Incident Activity. Rev. 3 (April 2025) maps IR to the CSF 2.0 functions instead, but CC still teaches the four phases.
• Within the response: contain first to stop the spread, eradicate the cause, then recover systems, never in reverse order.
• SANS PICERL (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) is the same process in six steps.
• The CSIRT is a predefined cross-functional team: lead, technical analysts, management, legal, communications, and HR.
• To preserve evidence and restore service: isolate, capture a forensic image under a chain-of-custody record, then rebuild or restore.
• Chain of custody is the documented, unbroken record of who handled evidence, when, and how; a broken chain can make evidence inadmissible.
• Exercises trade realism for disruption: checklist and tabletop discuss, simulations perform the steps in an isolated environment, full-scale exercises act on production.

Asset Lifecycle, Configuration Management, and Change Management

• You cannot protect what you do not know you have: the asset inventory is the foundation of asset protection.
• The asset lifecycle runs acquisition, deployment, use, maintenance, and secure disposal; an asset is recorded at acquisition, even while it waits in storage.
• End of life assets receive no more security patches (existing licenses and installed patches remain), so they must be replaced or, failing that, isolated and monitored.
• When several EOL assets need replacing, exposure decides the order: whatever is reachable from the internet first, already-segmented systems last.
• Media must be sanitized (overwritten, degaussed) or physically destroyed before disposal; deleting and reformatting are not enough.
• A secure baseline is the documented, approved, hardened configuration every system of a type must match.
• If every system matches its baseline yet shares the same weakness, the baseline is flawed: audits cannot see it, so fix and re-harden the baseline.
• Configuration drift is unplanned deviation from the baseline; detect it with audits and correct it through change management.
• The change management order is request, review and approval, test, implement, document, with a rollback plan prepared before implementing.
• Emergency changes may be implemented before full approval, but they are always reviewed and documented afterward.

Security Testing: Red, Blue, and Purple Teams, Scanning, SAST, and DAST

• Red team attacks, blue team defends, purple team is red and blue collaborating to improve both; the white team referees and oversees the exercise.
• An unannounced red team measures the blue team's unaided detection and response; purple teaming improves detections but cannot measure unaided performance.
• Vulnerability scanning is automated, broad, and identifies known weaknesses; credentialed scans are more accurate, but no scan exploits anything.
• Penetration testing is authorized, manual, and deep: testers exploit vulnerabilities to demonstrate real impact.
• SAST examines source code without running it; DAST tests the running application from the outside.
• Threat modeling identifies threats during design using STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege); repudiation means the system cannot prove who did something, tampering means the data was altered.
• Physical penetration testing targets human and physical controls using phishing, tailgating, and impersonation.
• All legitimate security testing, even a non-intrusive scan, is authorized and scoped by rules of engagement; a target outside scope waits until the scope is updated in writing.